Privacy Policy

Draft for review. This is a working first draft, not final legal content. It must be reviewed by a legal professional, and every placeholder in [brackets] completed, before it is published. Remove this notice once the review is done.

Last updated: [date to be set on publication]

This Privacy Policy explains how itndesign (Pty) Ltd t/a SymplTorque ("SymplTorque", "we", "us") collects, uses, shares and protects personal information when you visit www.sympltorque.co.za or use the SymplTorque workshop management software and related services (the "Service"). It should be read together with our POPIA Notice, which sets out your rights under South Africa's Protection of Personal Information Act, 2013 (POPIA) in more detail, and our Terms of Service.

Who we are

SymplTorque is operated by itndesign (Pty) Ltd t/a SymplTorque, a company registered in South Africa (registration number 2013/154587/07), with its registered address at 1st Floor, Block B, North Park, Black River Park, 2 Fir Street, Observatory, Cape Town, Western Cape, South Africa, 7925. Our Information Officer is still to be appointed; in the meantime you can contact us about privacy at connect@sympltorque.co.za.

The information we collect

We collect the following categories of personal information:

Account and contact information you give us when you enquire, join our early-access community, or create an account: your name, your workshop's name, email address, phone or WhatsApp number, and role.
Billing information needed to manage a subscription. Card payments are handled by our payment partner (see "Yoco and payments" below); we do not store full card details on our systems.
Information you enter into the Service to run your workshop, which may include personal information about your own customers (for example vehicle owners), such as names, contact details, vehicle details, service history, photographs and signatures. We process this information on your behalf, as your operator, as explained in our POPIA Notice.
Usage and device information collected automatically when you use the website or app, such as pages visited, actions taken, approximate location, device type, and log data, used to keep the Service secure and to improve it.
Cookies and similar technologies, described under "Cookies" below.
Communications you send us by email, WhatsApp, SMS or through the Service.

How we use your information

To provide, operate, secure and support the Service.
To set up your account, onboard your workshop, and provide early access.
To bill you, take payment, and keep records required by law (including tax records under SARS requirements).
To send you service messages, updates and, where you have agreed, marketing about SymplTorque.
To respond to your enquiries and provide support.
To detect, prevent and address technical issues, fraud and misuse.
To comply with our legal obligations.
To understand how the Service is used and to improve it.

Our lawful basis

We process personal information where processing is necessary to perform our contract with you, where you have consented, where it is required to meet a legal obligation, or where we have a legitimate interest that is not overridden by your rights. Our POPIA Notice sets out how this maps to the conditions for lawful processing under POPIA. [Confirm the lawful bases with your legal reviewer.]

Yoco and payments

Card payments and payment links are processed by Yoco, who handle your card information under their own terms and privacy policy. We receive confirmation of payment and limited transaction details, not your full card number.

Who we share information with

We do not sell your personal information. We share it only as needed to run the Service and meet our obligations, including with:

Service providers (operators) who process information on our behalf under written agreement, such as Amazon Web Services (our hosting provider), BulkSMS (our SMS provider), and Yoco (our payment provider).
Professional advisers such as accountants and lawyers, where necessary.
Authorities where we are required to disclose information by law, or to protect our rights, users or the public.
A successor in the event of a business sale or reorganisation, subject to this policy.

Where your information is stored

Your information is hosted with Amazon Web Services (AWS) in its Cape Town Region, so it is stored in South Africa. If any personal information is processed outside South Africa by a service provider, we take steps to ensure it is protected in line with POPIA's requirements for cross-border transfers. [Confirm whether any sub-processor processes personal information outside South Africa.]

How long we keep it

We keep personal information for as long as your account is active and for as long afterwards as we need it to meet our legal, tax and accounting obligations. Tax records that support VAT invoices and financial transactions are kept for seven years. More generally, we retain data on our systems for up to ten years under our internal data-retention policy. We aim not to keep personal information for longer than necessary for the purpose it was collected, and we delete or de-identify information we no longer need. [Confirm with your attorney that the seven-year tax basis and the ten-year retention policy are defensible under POPIA's minimisation principle for each category of personal information, in particular the end-customer data held as operator.]

How we protect it

We use reasonable technical and organisational measures to protect personal information against loss, unauthorised access and misuse [list the specific safeguards actually in place, for example access controls, encryption in transit and secure hosting, once confirmed]. No system is perfectly secure, but we work to protect your information and, if a security compromise affecting your personal information occurs, to notify you and the Information Regulator as POPIA requires.

Cookies

Our website uses a small number of cookies to make the site work and to remember your cookie choice. You can accept or decline non-essential cookies through the banner shown on your first visit, and you can clear cookies in your browser at any time. [Expand this section if analytics or marketing cookies are added.]

Your rights

You have rights over your personal information under POPIA, including the right to access it, ask us to correct or delete it, object to certain processing, and complain to the Information Regulator. These rights, and how to exercise them, are set out in full in our POPIA Notice.

Children

The Service is intended for businesses and is not directed at children. We do not knowingly collect personal information from children.

Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the "last updated" date. Where changes are material, we will take reasonable steps to let you know.

Contact us

For any privacy question, or to exercise your rights, contact us at connect@sympltorque.co.za.